Authentication Bypass in go-chi chi Middleware by Company
CVE-2026-118681

6.3MEDIUM

Key Information:

Vendor

Go-chi

Status
Chi
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118681?

The go-chi chi middleware versions prior to 5.5.0 are susceptible to an authentication bypass due to an improper handling of routing contexts within the SupressNotFound middleware. This flaw allows unauthorized attackers to exploit the routing mechanism, potentially requesting paths associated with public outer routes. By doing so, attackers can bypass critical authentication middleware, directly accessing tenant-scoped data that should only be retrieved by authenticated users. Organizations utilizing impacted versions should upgrade to mitigate the risks associated with this vulnerability.

Affected Version(s)

chi 0 < 5.5.0

chi 5.5.0

References

https://github.com/go-chi/chi/security/advisories/GHSA-rq...
vendor-advisory
https://www.vulncheck.com/advisories/go-chi-chi-before-5....
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dpfkdlemtp
.